a iiiQ 3 m l

b

i NIST Special Publication 500-170

X— ....iMiuiiiiiiiii PUBLICATIONS

^ . Management Guide to the

Technology Protection of Information U.S. DEPARTMENT OF

COMMERCE

National Institute of Standards and

Technology

Resources

M _^_ Cheryl Helsing

r^Jl^St! Marianne Swanson

Mary Anne Todd
rheNational Institute of Standards and Technology1 was established by an act of Congress on March 3, 1901. The Institute's overall goal is to strengthen and advance the Nation's science and technology and

facilitate their effective application for public benefit. To this end, the Institute conducts research to assure international competitiveness and leadership of U.S. industry, science and technology. NIST work involves development

and transfer of measurements, standards and related science and technology, in support of continually improving

U.S. productivity, product quality and reliability, innovation and underlying science and engineering. The Institute's technical work is performed by the National Measurement Laboratory, the National Engineering Laboratory, the National Computer Systems Laboratory, and the Institute for Materials Science and Engineering.

The National Measurement Laboratory

Provides the national system of physical and chemical measurement;

coordinates the system with measurement systems of other nations and furnishes essential services leading to accurate and uniform

physical and chemical measurement throughout the Nation's scientific community, industry, and commerce; provides advisory and research

services to other Government agencies; conducts physical and chemical

research; develops, produces, and distributes Standard Reference

Materials; provides calibration services; and manages the National

Standard Reference Data System. The Laboratory consists of the following centers: The National Engineering Laboratory

Basic Standards2 Radiation Research

Chemical Physics

Analytical Chemistry

Provides technology and technical services to the public and private

sectors to address national needs and to solve national problems;

conducts research in engineering and applied science in support of these

efforts; builds and maintains competence in the necessary disciplines

required to carry out this research and technical service; develops engineering data and measurement capabilities; provides engineering measure- ment traceability services; develops test methods and proposes engineering standards and code changes; develops and proposes new

engineering practices; and develops and improves mechanisms to

transfer results of its research to the ultimate user. The Laboratory

consists of the following centers: The National Computer Systems Laboratory

Computing and Applied

Mathematics

Electronics and Electrical Engineering2 Manufacturing Engineering

Building Technology

Fire Research

Chemical Engineering3

Conducts research and provides scientific and technical services to aid Federal agencies in the selection, acquisition, application, and use of

computer technology to improve effectiveness and economy in Government operations in accordance with Public Law 89-306 (40 U.S.C. 759), relevant Executive Orders, and other directives; carries out this mission

by managing the Federal Information Processing Standards Program,

developing Federal ADP standards guidelines, and managing Federal

participation in ADP voluntary standardization activities; provides scientific and technological advisory services and assistance to Federal

agencies; and provides the technical foundation for computer-related

policies of the Federal Government The Laboratory consists of the following divisions: The Institute for Materials Science and Engineering

Information Systems

Engineering

Systems and Software

Technology

Computer Security

Systems and Network

Architecture

Advanced Systems

Conducts research and provides measurements, data, standards, refer- ence materials, quantitative understanding and other technical information fundamental to the processing, structure, properties and perfor- mance of materials; addresses the scientific basis for new advanced

materials technologies; plans research around cross-cutting scientific themes such as nondestructive evaluation and phase diagram development; oversees Institute-wide technical programs in nuclear reactor

radiation research and nondestructive evaluation; and broadly disseminates generic technical information resulting from its programs. The

Institute consists of the following divisions:

Ceramics

Fracture and Deformation3 Polymers

Metallurgy Reactor Radiation

'Headquarters and Laboratories at Gaithersburg, MD, unless otherwise noted; mailing address Gaithersburg, MD 20899. ^ome divisions within the center are located at Boulder, CO 80303.

3 Located at Boulder, CO, with some elements at Gaithersburg, MD. _ . nnn a NATIONAL INSm^EOF^ANDAR^ *

Research Information Cestet

Gaithersburg, MD ARR»
NIST Special Publication 500-1 70 ^00

^.<Tfjt^nc

Management Guide to the

Protection of Information

Resources

Cheryl Helsing

Deloltte, Haskins & Sells

Marianne Swanson

Mary Anne Todd

National Computer Systems Laboratory

National Institute of Standards and Technology

Galthersburg, MD 20899

October 1989

U.S. DEPARTMENT OF COMMERCE

Robert A. Mosbacher, Secretary

NATIONAL INSTITUTE OF STANDARDS

AND TECHNOLOGY

Raymond G. Kammer, Acting Director NET
Reports on Computer Systems Technology

The National Institute of Standards and Technology (NIST) (formerly the National Bureau of Standards)

has a unique responsibility for computer systems technology within the Federal government. NIST's

National Computer Systems Laboratory (NCSL) develops standards and guidelines, provides technical

assistance, and conducts research for computers and related telecommunications systems to achieve more effective utilization of Federal information technology resources. NCSL's responsibilities include

development of technical, management, physical, and administrative standards and guidelines for the

cost-effective security and privacy of sensitive unclassified information processed in Federal computers.

NCSL assists agencies in developing security plans and in improving computer security awareness training. This Special Publication 500 series reports NCSL research and guidelines to Federal agencies as well as to organizations in industry, government, and academia.

Library of Congress Catalog Card Number: 89-600763

National Institute of Standards and Technology Special Publication 500-170

Natl. Inst. Stand. Technol. Spec. Publ. 500-170, 20 pages (Oct. 1989)

CODEN: NSPUE2

U.S. GOVERNMENT PRINTING OFFICE

WASHINGTON: 1989

For sale by the Superintendent of Documents, U.S. Government Printing Office, Washington, DC 20402
The National Institute of Standards and Technology (NIST), is responsible for developing standards, providing technical assistance, and conducting research for computers and related systems.

These activities provide technical support to government and industry in the effective, safe, and

economical use of computers. With the passage of the Computer Security Act of 1987 (P.L. 100-

235), NIST's activities also include the development of standards and guidelines needed to assure

the cost-effective security and privacy of sensitive information in Federal computer systems. This

guide represents one activity towards the protection and management of sensitive information

resources.

Acknowledgments

This guide was written by Cheryl Helsing of Deloitte, Haskins & Sells in conjunction with

Marianne Swanson and Mary Anne Todd, National Institute of Standards and Technology.

Executive Summary

Today computers are integral to all aspects of operations

within an organization. As Federal agencies are becoming criti- cally dependent upon computer information systems to carry

out their missions, the agency executives (policy makers) are recognizing that computers and computer-related problems

must be understood and managed, the same as any other

resource. They are beginning to understand the importance of

setting policies, goals, and standards for protection of data, information, and computer resources, and are committing resources for information security programs. They are also learning

that primary responsibility for data security must rest with the

managers of the functional areas supported by the data.

All managers who use any type of automated information

resource system must become familiar with their agency's

policies and procedures for protecting the information which is processed and stored within them. Adequately secure systems

deter, prevent, or detect unauthorized disclosure, modification, or use of information. Agency information requires protection

from intruders, as well as from employees with authorized computer access privileges who attempt to perform unauthorized

actions. Protection is achieved not only by technical, physical

and personnel safeguards, but also by clearly articulating and

implementing agency policy regarding authorized system use to information users and processing personnel at all levels. This

guide is one of three brochures that have been designed for a

specific audience. The "Executive Guide to the Protection of

Information Resources" and the "Computer User's Guide to

the Protection of Information Resources" complete the series.

v

Table of Contents

Executive Summary v

Introduction 1 Purpose of Guide 1 The Risks 1 Responsibilities 2

Information Systems Development 5

Control Decisions 5

Security Principles 5

Access Decisions 7

Systems Development Process 7

Computer Facility Management 9

Physical Security 9

Data Security 11

Monitoring and Review 11

Personnel Management 13

Personnel Security 13

Training 14

For Additional Information 15

vii

Introduction

Purpose ofthis Guide This guide introduces information systems security concerns and outlines the issues that must be addressed by all agency

managers in meeting their responsibilities to protect information systems within their organizations. It describes essential

components of an effective information resource protection

process that applies to a stand alone personal computer or to a large data processing facility.

The Risks Effort is required by every Federal agency to safeguard information resources and to reduce risks to a prudent level. The

spread of computing power to individual employees via personal computers, local-area networks, and distributed processing has drastically changed the way we manage and control information resources. Internal controls and control points that

were present in the past when we were dealing with manual or batch processes have not been established in many of today's

automated systems. Reliance upon inadequately controlled

computer systems can have serious consequences, including:

• Inability or impairment of the agency's ability to perform its mission

• Inability to provide needed services to the public

• Waste, loss, misuse, or misappropriation of funds

• Loss of credibility or embarrassment to an agency

To avoid these consequences, a broad set of information

security issues must be effectively and comprehensively addressed.

1
Introduction

Responsibilities All functional managers have a responsibility to implement the

policies and goals established by executive management for

protection of automated information resources (data, processes, facilities, equipment, personnel, and information).

Managers in all areas of an organization are clearly accountable for the protection of any of these resources assigned to

them to enable them to perform their duties. They are responsible for developing, administering, monitoring, and enforcing

internal controls, including security controls, within their as- signed areas of authority. Each manager's specific responsibilities will vary, depending on the role that manager has with

regard to computer systems.

Portions of this document provide more detailed information

on the respective security responsibilities of managers of computer resources, managers responsible for information systems

applications and the personnel security issues involved.

However, all agency management must strive to:

Achieve Cost-Effective Security

The dollars spent for security measures to control or contain

losses should never be more than the projected dollar loss if something adverse happened to the information resource. Costeffective security results when reduction in risk through implementation of safeguards is balanced with costs. The greater

the value of information processed, or the more severe the con- sequences if something happens to it, the greater the need for

control measures to protect it.

The person who can best determine the value or importance of

data is the functional manager who is responsible for the data.

For example, the manager responsible for the agency's budget

program is the one who should establish requirements for the

protection of the automated data which supports the program.

This manager knows better than anyone else in the organization what the impact will be if the data is inaccurate or unavailable. Additionally, this manager usually is the supervisor of

most of the users of the data.

2
Introduction

It is important that these trade-offs of cost versus risk reduction be explicitly considered, and that management understand

the degree of risk remaining after selected controls are implemented.

Assure Operational Continuity

With ever-increasing demands for timely information and

greater volumes of information being processed, the threat of

information system disruption is a very serious one. In some

cases, interruptions of only a few hours are unacceptable. The

impact due to inability to process data should be assessed, and

actions should be taken to assure availability of those systems

considered essential to agency operation. Functional management must identify critical computer applications and develop

contingency plans so that the probability of loss of data processing and telecommunications support is minimized.

Maintain Integrity

Integrity of information means you can trust the data and the

processes that manipulate it. Not only does this mean that er- rors and omissions are minimized, but also that the information system is protected from deliberate actions to wrongfully

change the data. Information can be said to have integrity when

it corresponds to the expectations and assumptions of the users.

Assure Confidentiality

Confidentiality of sensitive data is often, but not always, a re- quirement of agency systems. Privacy requirements for personal information is dictated by statute, while confidentiality of

other agency information is determined by the nature of that information, e.g., information submitted by bidders in procurement actions. The impact of wrongful disclosure must be considered in understanding confidentiality requirements.

Comply with Applicable Laws and Regulations

As risks and vulnerabilities associated with information sys- tems become better understood, the body of law and regulations compelling positive action to protect information resources grows. OMB Circular No. A- 130, "Management of Federal

Information Resources" and Public Law 100-235, "Computer

Security Act of 1987" are two documents where the knowledge

of these regulations and laws provide a baseline for an information resource security program.

3

Information Systems Development

This section describes the protective measures that should be

included as part of the design and development of information

processing application systems. The functional manager that is responsible for and will use the information contained in the

system, must ensure that security measures have been included

and are adequate. This includes applications designed for personal computers as well as large mainframes.

Control Decisions The official responsible for the agency function served by the

automated information system has a critical role in making

decisions regarding security and control. In the past, risk was

often unconsciously accepted when such individuals assumed

the computer facility operators were taking care of security. In

fact, there are decisions to be made and security elements to be

provided that cannot be delegated to the operator of the sys- tem. In many cases, the user or manager develops the application and operates solely.

The cost of control must be balanced with system efficiency

and usability issues. Risk must be evaluated and cost-effective

controls selected to provide a prudent level of control while

maximizing productivity. Controls are often closely connected

with the system function, and cannot be effectively designed

without significant understanding of the process being

automated.

Security Principles There are some common security attributes that should be

present in any system that processes valuable personal or sensitive information. System designs should include mechanisms to

enforce the following security attributes.

5
Information Systems Development

Identification and Authentication of Users

Each user of a computer system should have a unique identification on the system, such as an account number or other user identification code. There must also be a means of verifying that the individual claiming that identity (e.g., by typing in

that identifying code at a terminal) is really the authorized individual and not an imposter. The most common means of

authentication is by a secret password, known only to the

authorized user.

Authorization Capability Enforcing the Principle of Least

Possible Privilege

Beyond ensuring that only authorized individuals can access the system, it is also necessary to limit the users access to information and transaction capabilities. Each person should be

limited to only the information and transaction authority that is required by their job responsibilities. This concept, known as the principle of least possible privilege, is a long-standing control practice. There should be a way to easily assign each user

just the specific access authorities needed.

Individual Accountability

From both a control and legal point of view, it is necessary to

maintain records of the activities performed by each computer

user. The requirements for automated audit trails should be

developed when a system is designed. The information to be

recorded depends on what is significant about each particular

system. To be able to hold individuals accountable for their actions, there must be a positive means of uniquely identifying

each computer user and a routinely maintained record of each

user's activities.

Audit Mechanisms

Audit mechanisms detect unusual events and bring them to the

attention of management. This commonly occurs by violation

reporting or by an immediate warning to the computer system

operator. The type of alarm generated depends on the serious- ness of the event.

A common technique to detect access attempts by unauthorized individuals is to count attempts. The security

monitoring functions of the system can automatically keep

track of unsuccessful attempts to gain access and generate an

alarm if the attempts reach an unacceptable number.

6
Information Systems Development

Performance Assurance

A basic design consideration for any information system should

be the ability to verify that the system is functioning as intended. Systems that are developed without such design considerations are often very difficult to independently audit or

review, leading to the possibility of unintended results or inaccurate processing.

Recoverability

Because Federal agencies can potentially be heavily dependent

on a computer system, an important design consideration is the

ability to easily recover from troublesome events, whether

minor problems or major disruptions of the system. From a design point of view, systems should be designed to easily recover from minor problems, and to be either transportable to

another backup computer system or replaced by manual

processes in case of major disruption or loss of computer

facility.

Access Decisions Once the automated system is ready to use, decisions must be

made regarding access to the system and the information it contains. For example, many individuals require the ability to ac- cess and view data, but not the ability to change or delete data.

Even when computer systems have been designed to provide

the ability to narrowly designate access authorities, a knowledgeable and responsible official must actually make

those access decisions. The care that is taken in this process is a major determining factor of the level of security and control

present in the system. If sensitive data is being transmitted over unprotected lines, it can be intercepted or passive eavesdropping can occur. Encrypting the files will make the data unintelligible and port protection devices will protect the files from

unauthorized access, if warranted.

Systems Development Process All information systems software should be developed in a controlled and systematic manner according to agency standards.

The quality and efficiency of the data processed, and the possible reconfiguration of the system can all be affected by an inadequate development process. The risk of security exposures

and vulnerabilities is greatly reduced when the systems

development process is itself controlled.

7

Computer Facility Management

Functional managers play a critical role in assuring that agency

information resources are appropriately safeguarded. This sec- tion describes the protective measures that should be incorporated into the ongoing management of information resource

processing facilities. As defined in OMB Circular No. A- 130,

"Management of Federal Information Resources," the term "information technology facility" means an organizationally

defined set of personnel, hardware, software, and physical

facilities, a primary function of which is the operation of information technology. This section, therefore applies to any

manager who houses a personal computer, mainframe or any

other form of office system or automated equipment.

Physical Security Information cannot be appropriately protected unless the

facilities that house the equipment are properly protected from

physical threats and hazards. The major areas of concern are described below.

Environmental Conditions

For many types of computer equipment, strict environmental

conditions must be maintained. Manufacturer's specifications

should be observed for temperature, humidity, and electrical

power requirements.

Control of Media

The media upon which information is stored should be carefully controlled. Transportable media such as tapes and cartridges

should be kept in secure locations, and accurate records kept

of the location and disposition of each. In addition, media from

an external source should be subject to a check-in process to ensure it is from an authorized source.

9
Computer Facility Management

Control of Physical Hazards

Each area should be surveyed for potential physical hazards.

Fire and water are two of the most damaging forces with regard

to computer systems. Opportunities for loss should be minimized by an effective fire detection and suppression

mechanism, and planning reduces the danger of leaks or flooding, Other physical controls include reducing the visibility of

the equipment and strictly limiting access to the area or equipment.

Contingency Planning

Although risks can be minimized, they cannot be eliminated.

When reliance upon a computer facility or application is substantial, some type of contingency plan should be devised to

allow critical systems to be recovered following a major disaster, such as a fire. There are a number of alternative approaches that should be evaluated to most cost-effectively

meet the agency's need for continuity of service.

Configuration Management

Risk can be introduced through unofficial and unauthorized

hardware or software. Another key component of information

resource management is ensuring only authorized hardware

and software are being utilized. There are several control is- sues to be addressed.

Maintaining Accurate Records

Records of hardware/software inventories, configurations, and

locations should be maintained and kept up-to-date.

Complying with Terms of Software Licenses

Especially with microcomputer software, illegal copying and

other uses in conflict with licensing agreements are concerns. The use of software subject to licensing agreements must be

monitored to ensure it is used according to the terms of the

agreement.

10
Computer Facility Management

Protecting Against Malicious Software and Hardware

The recent occurrences of destructive computer "viruses" point

to the need to ensure that agencies do not allow unauthorized

software to be introduced to their computer environments. Unauthorized hardware can also contain hidden vulnerabilities.

Management should adopt a strong policy against unauthorized

hardware/software, inform personnel about the risks and conse- quences of unauthorized additions to computer systems, and

develop a monitoring process to detect violations of the policy.

Data Security Management must ensure that appropriate security

mechanisms are in place that allow responsible officials to

designate access to data according to individual computer

users' specific needs. Security mechanisms should be sufficient

to implement individual authentication of system users, allow

authorization to specific information and transaction

authorities, maintain audit trails as specified by the responsible

official, and encrypt sensitive files if required by user management.

Monitoring and Review A final aspect of information resource protection to be considered is the need for ongoing management monitoring and

review. To be effective, a security program must be a continuous effort. Ideally, ongoing processes should be adapted to

include information protection checkpoints and reviews. Information resource protection should be a key consideration in all major computer system initiatives.

Earlier, the need for system audit trails was discussed. Those

audit trails are useful only if management regularly reviews ex- ception items or unusual activities. Irregularities should be re- searched and action taken when merited. Similarly, all information-related losses and incidents should be investigated.

11
Computer Facility Management

A positive benefit of an effective monitoring process is an increased understanding of the degree of information-related

risk in agency operations. Without an ongoing feedback

process, management may unknowingly accept too much risk.

Prudent decisions about trade-offs between efficiency and control can only be made with a clear understanding of the degree

of inherent risk. Every manager should ask questions and periodically review operations to judge whether changes in the en- vironment have introduced new risk, and to ensure that controls are working effectively.

12
Personnel Management

Managers must be aware that information security is more a people issue than a technical issue. Personnel are a vital link in

the protection of information resources, as information is gathered by people, entered into information resource systems

by people, and ultimately used by people. Security issues

should be addressed with regard to:

• People who use computer systems and store information in

the course of their normal job responsibilities

• People who design, program, test, and implement critical or

sensitive systems

• People who operate computer facilities that process critical or sensitive data

Personnel Security From the point of hire, individuals who will have routine access

to sensitive information resources should be subject to special

security procedures. More extensive background or reference

checks may be appropriate for such positions, and security

responsibilities should be explicitly covered in employee orientations. Position descriptions and performance evaluations

should also explicitly reference unusual responsibilities affecting the security of information resources.

Individuals in sensitive positions should be subject to job rotation, and work flow should be designed in such a way as to

provide as much separation of sensitive functions as possible.

Upon decision to terminate or notice of resignation, expedited

termination or rotation to less sensitive duties for the

remainder of employment is a reasonable precaution.

Any Federal computer user who deliberately performs or at- tempts to perform unauthorized activity should be subject to

disciplinary action, and such disciplinary action must be

uniformly applied throughout the agency. Any criminal activity

under Federal or state computer crime laws must be reported

to law enforcement authorities.

13
Most information resource security problems involve people.

Problems can usually be identified in their earliest stages by

people who are attuned to the importance of information

protection issues. A strong training program will yield large

benefits in prevention and early detection of problems and losses. To be most effective, training should be tailored to the particular audience being addressed, e.g., executives and policy

makers; program and functional managers; IRM security and

audit: ADP management and operations; end users.

Most employees want to do the right thing, if agency expectations are clearly communicated. Internal policies can be en- forced only if staff have been made aware of their individual

responsibilities. All personnel who access agency computer sys- tems should be aware of their responsibilities under agency

policy, as well as obligations under the law. Disciplinary actions

and legal penalties should be communicated.
For Additional Information

National Institute Of Standards and Technology

Computer Security Program Office

A-216 Technology

Gaithersburg, MD 20899

(301) 975-5200

For further information on the management of information resources, NIST publishes Federal In- formation Processing Standards Publications (FIBS PUBS). These publications deal with many

aspects of computer security, including password usage, data encryption, ADP risk management

and contingency planning, and computer system security certification and accreditation. A list of

current publications is available from:

Standards Processing Coordinator (ADP)

National Computer Systems Laboratory

National Institute of Standards and Technology

Technology Building, B-64

Gaithersburg, MD 20899

Phone: (301) 975-2817

15

^ U . S . GOVERNMENT PRINTING OFFICEi 1989—261—913/00074

ANNOUNCEMENT OF NEW PUBLICATIONS ON

COMPUTER SYSTEMS TECHNOLOGY

Superintendent of Documents

Government Printing Office

Washington, DC 20402

Dear Sir:

Please add my name to the announcement list of new publications to be issued in the series: National Institute of Standards and Technology Special Publication 500-

.

Name

Company

Address

City State Zip Code

(Notification key N-503)

NBS-114A (rev. 2-80) U.S. DEPT. OF COMM.

BIBLIOGRAPHIC DATA

SHEET (See instructions)

1. PUBLICATION OR

REPORT NO.

NIST/SP-500/170

2. Performing Organ. Report No 3. Publication Date

October 1989

4. TITLE AND SUBTITLE

Management Guide To The Protection of Information Resources

5. AUTHOR(S)

Cheryl Helsing, Marianne Swanson, and Mary Anne Todd

6. PERFORMING ORGANIZATION (If joint or other than NBS. see instructions)

NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY

(formerly NATIONAL BUREAU OF STANDARDS)

U.S. DEPARTMENT OF COMMERCE

OAITHERSBURG, MD 20899

7. Contract/Grant No.

8. Type of Report & Period Covered

Final

9. SPONSORING ORGANIZATION NAME AND COMPLETE ADDRESS (Street. City. State. ZIP)

Same as item #6

10. SUPPLEMENTARY NOTES

Library of Congress Catalog Card Number: 89-600763

I | Document describes a computer program; SF-185, FlPS Software Summary, is attached.

11. ABSTRACT (A 200-word or less factual summary of most si gnificant information. If document includes a significant

bibliography or literature survey, mention it here)

The primary responsibility for data security rests with the managers of the

functional areas supported by the data. This booklet introduces information

system security concerns, and describes the essential components of an effective

information resource protection process.

12. KEY WORDS (Six to twelve entries; alphabetical order; capitalize only proper names; and separate key words by semicolons)

confidentiality; configuration management; controls; functional managers;

information resources; integrity; personnel security; physical security;

responsibilities; risks; security mechanisms

13. AVAILABILITY

[jp Unlimited

| | For Official Distribution. Do Not Release to NTIS

[y~| Order From Superintendent of Documents, U.S. Government Printing Office, Washington, D.C. 20402. QOrder From National Technical Information Service (NTIS), Springfield, VA. 22161

14. NO. OF

PRINTED PAGES

20

15. Price

USCOMM-DC 6043-P80

1 tX>J X Technical Publications

Periodical

Journal of Research of the National Institute of Standards and Technology—Reports NIST research

and development in those disciplines of the physical and engineering sciences in which the Institute

is active. These include physics, chemistry, engineering, mathematics, and computer sciences.

Papers cover a broad range of subjects, with major emphasis on measurement methodology and

the basic technology underlying standardization. Also included from time to time are survey articles on topics closely related to the Institute's technical and scientific programs. Issued six times a year.

Nonperiodicals

Monographs—Major contributions to the technical literature on various subjects related to the

Institute's scientific and technical activities. Handbooks—Recommended codes of engineering and industrial practice (including safety codes) developed in cooperation with interested industries, professional organizations, and regulatory bodies.

Special Publications—Include proceedings of conferences sponsored by NIST, NIST annual reports,

and other special publications appropriate to this grouping such as wall charts, pocket cards, and

bibliographies.

Applied Mathematics Series—Mathematical tables, manuals, and studies of special interest to physicists, engineers, chemists, biologists, mathematicians, computer programmers, and others engaged in scientific and technical work.

National Standard Reference Data Series—Provides quantitative data on the physical and chemical

properties of materials, compiled from the world's literature and critically evaluated. Developed un- der a worldwide program coordinated by NIST under the authority of the National Standard Data

Act (Public Law 90-396). NOTE: The Journal of Physical and Chemical Reference Data (JPCRD)

is published quarterly for NIST by the American Chemical Society (ACS) and the American Insti- tute of Physics (AIP). Subscriptions, reprints, and supplements are available from ACS, 1155 Six- teenth St., NW., Washington, DC 20056.

Building Science Series—Disseminates technical information developed at the Institute on building

materials, components, systems, and whole structures. The series presents research results, test methods, and performance criteria related to the structural and environmental functions and the

durability and safety characteristics of building elements and systems.

Technical Notes—Studies or reports which are complete in themselves but restrictive in their treat- ment of a subject. Analogous to monographs but not so comprehensive in scope or definitive in treatment of the subject area. Often serve as a vehicle for final reports of work performed at NIST

under the sponsorship of other government agencies.

Voluntary Product Standards—Developed under procedures published by the Department of Commerce in Part 10, Title 15, of the Code of Federal Regulations. The standards establish nationally

recognized requirements for products, and provide all concerned interests with a basis for common

understanding of the characteristics of the products. NIST administers this program as a supplement

to the activities of the private sector standardizing organizations.

Consumer Information Series—Practical information, based on NIST research and experience, covering areas of interest to the consumer. Easily understandable language and illustrations provide useful background knowledge for shopping in today's technological marketplace.

Order the above NISTpublications from: Superintendent of Documents, Government Printing Office,

Washington, DC 20402.

Order the following NISTpublications—FIPS and NISTIRs—from the National Technical Information

Service, Springfield, VA 22161.

Federal Information Processing Standards Publications (FIPS PUB)—Publications in this series col- lectively constitute the Federal Information Processing Standards Register. The Register serves as the official source of information in the Federal Government regarding standards issued by NIST

pursuant to the Federal Property and Administrative Services Act of 1949 as amended, Public Law

89-306 (79 Stat. 1127), and as implemented by Executive Order 11717 (38 FR 12315, dated May 11, 1973) and Part 6 of Title 15 CFR (Code of Federal Regulations).

NIST Interagency Reports (NISTIR)—A special series of interim or final reports on work performed

by NIST for outside sponsors (both government and non-government). In general, initial distribu- tion is handled by the sponsor; public distribution is by the National Technical Information Service,

Springfield, VA 22161, in paper copy or microfiche form.
U.S. Department of Commerce

National Institute of Standards and Technology

(formerly National Bureau of Standards)

Gaithersburg, MD 20899

Official Business

Penalty for Private Use $300